CVE-2026-81009
Last modified
CVE-2026-81009 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: io_uring/query: cap user size passed to copy_struct_to_user io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but keeps the original user value as usize. copy_struct_to_user() uses that usize and, when it is larger than the kernel result, clear_user()s the trailing bytes. As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing, including on the error path where res_size stays 0.
Description
In the Linux kernel, the following vulnerability has been resolved: io_uring/query: cap user size passed to copy_struct_to_user io_handle_query_entry() clamps hdr.size for the inbound copy_from_user() but keeps the original user value as usize. copy_struct_to_user() uses that usize and, when it is larger than the kernel result, clear_user()s the trailing bytes. As hdr.size is a __u32, a query can request nearly 4 GiB of zeroing, including on the error path where res_size stays 0. The interface is reachable without a ring via IORING_REGISTER_QUERY. Reject sizes larger than PAGE_SIZE, as recommended for copy_struct_* interfaces.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= c265ae75f900cea4e415230a77b5d152377627dd, < 417e02f7b6051765b91cf1289071882eebd172e0; >= c265ae75f900cea4e415230a77b5d152377627dd, < 2b8ad4981ecedb14c1fdd811ab977010b23933e6; >= c265ae75f900cea4e415230a77b5d152377627dd, < ba77efee1b95b4ad7559b1cdbe7cd7fa36dca95b |
| Linux | Linux | 6.18 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-81009?
How severe is CVE-2026-81009?
How do I fix CVE-2026-81009?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-81003In the Linux kernel, the following vulnerability has been re…8.1
- CVE-2026-81004In the Linux kernel, the following vulnerability has been re…8.4
- CVE-2026-81005In the Linux kernel, the following vulnerability has been re…
- CVE-2026-81006In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-81007In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2026-81008In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-81010In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-81011In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2026-81012In the Linux kernel, the following vulnerability has been re…8.4
- CVE-2026-81013In the Linux kernel, the following vulnerability has been re…
- CVE-2026-81014In the Linux kernel, the following vulnerability has been re…
- CVE-2026-81015In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2026-81009?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST